The flaw is a command injection vulnerability in Dokploy’s backup.listBackupFiles tRPC endpoint. The endpoint passes a user‑supplied search parameter through normalizeS3Path and interpolates it directly into an rclone lsjson command that is executed via child_process.exec(). This allows an authenticated user with backup:read permissions to execute arbitrary shell commands on the Dokploy host. The vulnerability is a classic example of CWE‑78: Improper Restriction of Operations within the Bounds of a Fenced Context.

All Dokploy instances running a version older than 0.29.13 are vulnerable. The flaw originates in the backup router located at apps/dokploy/server/api/routers/backup.ts. The affected product is the free, self‑hostable Dokploy Platform as a Service. Users should verify that their Dokploy installation is not running a pre‑0.29.13 release.

The CVSS base score of 9.9 indicates critical severity. Although the EPSS score is not available, the risk remains high because an attacker only needs authenticated access with backup:read permission to exploit the flaw. Once a malicious search string is supplied, arbitrary code runs with the privileges of the Dokploy service process, providing full control over the host. The vulnerability is not listed in CISA’s KEV catalog, but the severity alone warrants urgent action, especially in environments where Dokploy is exposed to external users or services. The issue is fixed in release 0.29.13; until that version is applied, the vulnerability can be leveraged to compromise the entire host.